Ubuntu update for ffmpeg

1) Integer overflow

EUVDB-ID: #VU101884

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-36617

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within CAF decoder. A remote attacker can pass specially crafted file to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 22.04

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

CPE2.3

• cpe:2.3:o:canonical:ubuntu:16.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:18.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:libavdevice-ffmpeg56_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libav-tools_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavutil-ffmpeg54_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavcodec-ffmpeg-extra56_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavformat-ffmpeg56_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavcodec-ffmpeg56_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libpostproc-ffmpeg53_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavfilter-ffmpeg5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libswscale-ffmpeg3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavresample-ffmpeg2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libswresample-ffmpeg1_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavcodec57_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavcodec-extra57_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavfilter6_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavfilter-extra6_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavformat57_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavdevice57_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libpostproc54_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libswscale4_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libswresample2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavresample3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavutil55_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavresample4_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavcodec58_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavfilter7_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavutil56_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavfilter-extra7_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavcodec-extra58_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavformat-extra58_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavdevice58_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libswscale5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libswresample3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libpostproc55_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:libavformat58_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:ffmpeg_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

http://ubuntu.com/security/notices/USN-7188-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.